By Martin Hartley, Group CCO, emagine
Few sectors understand the importance of governance, risk, and accountability better than financial services. So, as banks and financial institutions continue investing in increasingly sophisticated AI technologies, it is unsurprising that responsible AI has risen rapidly up the corporate agenda.
But the discussions around responsible AI tend to follow the universally accepted narrative around governance. While frameworks, policies, and controls are clearly important, these alone cannot determine whether AI is actually being used responsibly. For that, I would argue that financial institutions need something more fundamental: operational readiness.
Operational readiness means ensuring people using AI have the skills to do so appropriately, that ownership and accountability are clearly defined, and that controls operate within everyday workflows rather than sitting somewhere alongside them as a separate compliance exercise. Put simply, responsible AI needs to work in practice, not just as a theoretical concept.
Awareness and capability are not the same
One of the biggest challenges I see is the tendency to conflate AI awareness with AI capability. Indeed, employees may understand what generative AI does and leaders will invariably appreciate its strategic significance, while the organisation itself commits significant investment in the technology and communicate policies governing its use.
However, it would be foolish to assume that this translates into employees understanding how to apply AI safely and effectively to the work they actually do. It does not.
This distinction becomes especially important within financial services, where AI-enabled decisions and processes can require clear accountability and appropriate human oversight. This should prompt organisations to ask some uncomfortable questions: Who is accountable when AI-enabled decisions go wrong? Do employees have the skills and approved tools to use AI appropriately? Who is responsible for challenging an output? And are safeguards embedded within the workflows where AI is being used?
If the answers are unclear, there is an operational gap regardless of how comprehensive the overarching AI policy might appear. Closing that gap should be part of accelerating adoption, with organisations defining the outcomes they expect, establishing clear accountability, and using those measures to guide investment and implementation.
Give people the capability to do the right thing
This also has implications for training. Indeed, too much enterprise AI training remains generic rather than tied to people’s actual roles, workflows, and expected business outcomes. This risks creating workforces that are high in awareness but low in genuine capability.
For instance, the AI tools used by a risk specialist will likely differ to those deployed by someone in operations, or the same tools may be used differently. Therefore, the capabilities they require must reflect the work they perform and the risks and outcomes associated with it.
There is another consequence that comes from that gap failing to be addressed effectively: shadow AI.
Employees who recognise that AI can make them more effective may seek out their own solutions if approved technology does not meet their needs. The use of public LLMs such as Claude and ChatGPT, unapproved note-takers, and third-party research assistants outside governed environments could create operational, governance and security risks, particularly where sensitive information is shared without appropriate oversight or controls
But the solution is not to tell people what they cannot use – that would be over-simplifying things. Rather, organisations need to provide the appropriate tools and the capabilities required to use them effectively, in the right way and for the right purpose.
Accountability cannot be automated
To say that AI has evolved since the launch of ChatGPT is a gross understatement and as AI gets more sophisticated the need to clear accountability intensifies.
Within the finance sector, agentic AI is pushing the technology beyond systems that generate content towards systems capable of acting across enterprise workflows. Greater organisational accountability is therefore essential to match the degree of technological autonomy.
Working with some of Europe’s largest financial institutions has reinforced my view that organisations need clearly defined ownership of AI-enabled processes and meaningful human oversight. Crucially, those providing that oversight need sufficient knowledge to question outputs, recognise problems, and intervene when appropriate.
Organisations wanting to deploy AI responsibly should therefore focus on four key fundamentals: defining ownership, building role-specific capability, maintaining meaningful human oversight, and measuring business outcomes alongside risk.
There are some industry commentators calling for a slowing AI adoption, but that would dismiss the entire premise around its adoption in the first place: to improve business and customer outcomes. Instead, financial organisations need to create the conditions that allow them to accelerate adoption with greater confidence.
Responsible AI should not ultimately be measured by the number of policies written or employees completing an AI training programme. The real and only test that matters is operational: whether people actually understand the technology and how it supports their workflows, whether accountability is clear, and whether controls function where the work actually happens. Responsible AI isn’t simply a governance challenge – it is an operational capability that financial institutions must build.